Paul Miseiko

**Name of the Vulnerable Software and Affected Versions** Rapid7 InsightVM (affected versions not specified) Nexpose (affected versions not specified) Rapid7 Insight Agent versions prior to 0.0.245.0 Rapid7 Scan Engine versions prior to 1.1.3935 **Description** Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership. This allows a local low-privileged user to execute arbitrary code with the privileges of the scan credential when using the Scan Engine, or as root/SYSTEM when using the Insight Agent. **Recommendations** Update Rapid7 Insight Agent to version 0.0.245.0 or later. Update Rapid7 Scan Engine to version 1.1.3935 or later.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows 2000 SP4 **Description** The issue is related to Active Directory in Microsoft Windows, where it does not properly allocate memory for LDAP and LDAPS requests. This allows remote attackers to execute arbitrary code via a crafted request. **Recommendations** For Microsoft Windows 2000 SP4, apply the necessary patch to fix the memory allocation issue in Active Directory.